Vulnerability disclosure policy

How to report

Email test@msn.com with a description, the affected component and steps to reproduce. You can also use the contact form with the topic "Security report". Our security.txt lists current contacts.

Scope

• This website, the customer portal, the web chat app and the homeserver at 0r834h.duckdns.org.
• The Lumen installer and operational scripts.
• Issues in upstream components (Synapse, the Matrix SDKs, vodozemac, Caddy) are welcome too; we'll coordinate with the upstream project.

Please don't

• Access, modify or delete other people's data, or degrade the service (no denial-of-service tests).
• Use social engineering, physical attacks or spam.
• Test against other Matrix servers you don't own.

What we commit to

• Acknowledge your report within 3 business days and keep you updated.
• Not pursue legal action for good-faith research that follows this policy.
• Credit you in our release notes, if you'd like.